FreeRDP before version 3.29.0 contains an out‑of‑bounds read in the async update message proxy for PolygonSC and PolygonCB drawing orders. When AsyncUpdate is enabled, the update_message_PolygonSC and update_message_PolygonCB functions allocate a new points array but copy point data from the address of the order structure instead of from the polygon’s points array, resulting in a client‑side out‑of‑bounds read. An attacker can exploit this by sending crafted PolygonSC/PolygonCB update orders from a malicious or compromised RDP server, potentially allowing memory disclosure or inducing a client crash. This is a CWE‑125 failure of input validation that can compromise confidentiality and disrupt availability on the client.

FreeRDP FreeRDP clients with a version earlier than 3.29.0 that enable AsyncUpdate processing are affected. Any installation of the FreeRDP client that runs with the /async-update option against an RDP server may be vulnerable.

The CVSS score of 8.7 indicates high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation yet. Exploitation requires a malicious or compromised server capable of sending crafted Polygon orders to an AsyncUpdate‑enabled client, making the attack vector remote via RDP. The impact can lead to confidential data exposure or client instability, affecting the user’s confidentiality and availability.